So the issue is that git-daemon is trying to be too smart.

Desired transaction:

Client: please send me ~lukeshu/nshd.git
Daemon: --base-path=/srv/git, so I'm looking up /srv/git/~lukeshu/nshd.git

but instead what happens is

Daemon: Oh! The path starts with a tilde,
so I should look up in that user's home directory, instead of in --base-path.
But wait, --user-path isn't set, so I shouldn't go to his home directory.
Ha, security-breaker! You haven't fooled me, I'll reject the request!
You can't trick me into serving a user's home directory!

When it obviously should just look in base-path if --user-path isn't enabled, instead of killing the request.